6 ms·

Why a BSD License Might be Wrong for your Embedded Open-Source Project

36 points by silentbicycle 13y ago

hvs 13y ago
Do you know, or necessarily care, who supplied the brakes in your car? Yes? That's probably not the best example since many people actually change the breaks in their car, whereas I believe the point of the OP was that this is a library that is compiled into the final product. That said, I don't think this is evidence that the BSD license is "broken" in some way. It simply requires that the user of your code cite that they used it. (I believe Microsoft failed to do this for a few years for their sockets code). Just like when you quote another text, you need to cite your source; the BSD license requires the same. If that's not your intention, don't use it, but don't blame the license.
- papsosouid 13y ago
  Nobody said the BSD license is "broken", nor did they blame the license for anything. He simply pointed out that the license is not appropriate for what many people actually want, and pointed to licenses that are appropriate for those goals. If you want a totally free license where people can do anything, but you still hold copyright, then you want ISC/MIT/zlib, not BSD. Many people do not realize this.
  - pi18n 13y ago
    I did not realize this and I am happy that I know now.
- silentbicycle 13y ago
  Author here. I don't think the BSD license is broken, just that the legal implications of that clause were surprising to me, and I thought I'd share what I learned. I'm still likely to use the BSD license in other contexts, but will probably default to MIT/ISC/zlib specifically for embedded libraries.
  - DannyBee 13y ago
    I'm just curious why this was surprising. It seems fairly straightforward. Was the surprising part that someone wanted to put it in hardware?
    - silentbicycle 13y ago
      It is straightforward if you read the license closely with hardware in mind, but I've been releasing stuff under the BSD license for much longer than I've been doing embedded development. I thought I knew what the BSD license meant, but my understanding of it hadn't considered the implications for hardware distribution, and I imagine that's true for most people. As interest grows in open-source hardware and embedded development, it's something worth drawing attention to. Not every vendor will mention the license, some will just shrug and move on.
      - DannyBee 13y ago
        "I thought I knew what the BSD license meant, but my understanding of it hadn't considered the implications for hardware distribution, and I imagine that's true for most people." Right, and no offense, but your solution was then to just solve this specific problem rather than ask about what other legal implications you were missing. For example, ISC specifically only mentions "this software". If you were to ISC license everything, but also include say, IC layouts, they arguably would not be covered. Worse, IC layouts ("mask works") are, in the US, a completely separate set of rights that are arguably not covered at all by the "use, copy, modify, and distribute" part of ISC (and have the software issue). Basically, there are a large set of issues with current licenses and open hardware, and you identified one, and then immediately switched to some other license without considering the other implications as well. It may well turn out for your particular project there are no other interesting implications, but as you say "Details like these are easy to gloss over, but they can have a major impact on whether open-source projects can actually be used by others." With no offense meant (really), I don't think what you've demonstrated is a good example of handling that well.
        13y ago
greenlakejake 13y ago
Why not just put stuff into the public domain?
- silentbicycle 13y ago
  The "public domain" designation has its own problems, nicely summarized on Google Code (https://code.google.com/p/support/wiki/FAQ#Can_I_host_code_that_I_have_placed_in_the_public_domain? https://code.google.com/p/support/wiki/FAQ#Can_I_host_code_t...). In particular, Dr. Richard Hipp (SQLite's main author) has talked about problems that came up from releasing it into the public domain. He eventually created a second license specifically for companies in places that didn't legally recognize the public domain, and wanted to make sure they were protected from liability. Licensing is complicated.
  - greenlakejake 13y ago
    Thanks for the link.
  - idupree 13y ago
    CC0 addresses these problems with "public domain"; its intent is the most permissive license that's legally possible (plus, in jurisdictions where it is possible, actually placing the work in the public domain). Unlike the other Creative Commons licenses, it it suitable for source code. ( http://wiki.creativecommons.org/CC0_FAQ http://wiki.creativecommons.org/CC0_FAQ , https://creativecommons.org/choose/zero/ https://creativecommons.org/choose/zero/ )
ciupicri 13y ago
I hate paperwork, but I suppose that providing a document with all the copyright notices along with the car, can't be that bad.
- silentbicycle 13y ago
  It was never my intention that people who use my open-source library complicate their supply chain by pushing additional work onto their customers. The paperwork wouldn't necessarily just mean slapping a post-it™ note on the product, it could involve paying for lawyers, translators, and so on.
- jwr 13y ago
  As someone who manages commercial software development projects (also for embedded devices) I can tell you that it is a royal pain to manage the copyright notices. It is a list that has to be created, maintained, updated and has to make its way into the final product or its documentation. You also have to manage copyright notices from software shipped by your partners. While you do this, your programmers will just drop in another library ("But I've checked the license, it's fine, it's BSD!") without telling you. And that library will have dependencies. Overall, if you want to do this right, it's a major pain, for very little actual gain (who reads these copyright notices anyway?).
  - silentbicycle 13y ago
    If you have any other recommendations for making this process smoother, please let me know. I want people in your situation to be able to use my libraries without these irritations. (Author of the post.)
    - jwr 13y ago
      The only thing that comes to mind is a unified standard for copyright statements. If I could be sure that there is a file called COPYRIGHT.statement in every source repo, containing a single line of text that I should include in the documentation, it would be a huge step forward. Unfortunately, this would require agreeing on a standard and having people follow it, so I'm not keeping my hopes up.
Symmetry 13y ago
I don't see why this is a problem. The manufacturer of the hardware is the only person bound by the license since they're the only people copying, the only people who need to have the software licensed to them. They're bound to give a copy of that notice to anyone who buys their stuff, but nobody downstream has to care, they're protected by the Doctrine of First Sale[1]. Unless the author lives in a country where that doesn't apply. [1]https://en.wikipedia.org/wiki/First-sale_doctrine https://en.wikipedia.org/wiki/First-sale_doctrine
- silentbicycle 13y ago
  I probably cannot discuss the specifics of the vendor, but I don't know if First Sale applies in their country. I'm not a lawyer, and their lawyers brought it up as a potential issue, so I'm inclined to take it at face value.
noselasd 13y ago
This is not that uncommon. e.g. many Broadcom SoCs uses various code from opensource projects - Broadcom doesn't sell to end users though. They publish a (small) document to their customers detailing what they have to do as they retail the end product using this particular chip. Which licenses they have to reproduce in documentation and which links to place there pointing to the original source code where that's required. If that's a burden you do not want to place on the customers - indeed, you need to be careful about the selected license.

36 points by silentbicycle 13y ago

hvs 13y ago

Do you know, or necessarily care, who supplied the brakes in your car? Yes? That's probably not the best example since many people actually change the breaks in their car, whereas I believe the point of the OP was that this is a library that is compiled into the final product. That said, I don't think this is evidence that the BSD license is "broken" in some way. It simply requires that the user of your code cite that they used it. (I believe Microsoft failed to do this for a few years for their sockets code). Just like when you quote another text, you need to cite your source; the BSD license requires the same. If that's not your intention, don't use it, but don't blame the license.

papsosouid 13y ago
Nobody said the BSD license is "broken", nor did they blame the license for anything. He simply pointed out that the license is not appropriate for what many people actually want, and pointed to licenses that are appropriate for those goals. If you want a totally free license where people can do anything, but you still hold copyright, then you want ISC/MIT/zlib, not BSD. Many people do not realize this.
- pi18n 13y ago
  I did not realize this and I am happy that I know now.
silentbicycle 13y ago
Author here. I don't think the BSD license is broken, just that the legal implications of that clause were surprising to me, and I thought I'd share what I learned. I'm still likely to use the BSD license in other contexts, but will probably default to MIT/ISC/zlib specifically for embedded libraries.
- DannyBee 13y ago
  I'm just curious why this was surprising. It seems fairly straightforward. Was the surprising part that someone wanted to put it in hardware?
  - silentbicycle 13y ago
    It is straightforward if you read the license closely with hardware in mind, but I've been releasing stuff under the BSD license for much longer than I've been doing embedded development. I thought I knew what the BSD license meant, but my understanding of it hadn't considered the implications for hardware distribution, and I imagine that's true for most people. As interest grows in open-source hardware and embedded development, it's something worth drawing attention to. Not every vendor will mention the license, some will just shrug and move on.
    - DannyBee 13y ago
      "I thought I knew what the BSD license meant, but my understanding of it hadn't considered the implications for hardware distribution, and I imagine that's true for most people." Right, and no offense, but your solution was then to just solve this specific problem rather than ask about what other legal implications you were missing. For example, ISC specifically only mentions "this software". If you were to ISC license everything, but also include say, IC layouts, they arguably would not be covered. Worse, IC layouts ("mask works") are, in the US, a completely separate set of rights that are arguably not covered at all by the "use, copy, modify, and distribute" part of ISC (and have the software issue). Basically, there are a large set of issues with current licenses and open hardware, and you identified one, and then immediately switched to some other license without considering the other implications as well. It may well turn out for your particular project there are no other interesting implications, but as you say "Details like these are easy to gloss over, but they can have a major impact on whether open-source projects can actually be used by others." With no offense meant (really), I don't think what you've demonstrated is a good example of handling that well.
      - 13y ago

greenlakejake 13y ago

Why not just put stuff into the public domain?

silentbicycle 13y ago
The "public domain" designation has its own problems, nicely summarized on Google Code (https://code.google.com/p/support/wiki/FAQ#Can_I_host_code_that_I_have_placed_in_the_public_domain? https://code.google.com/p/support/wiki/FAQ#Can_I_host_code_t...). In particular, Dr. Richard Hipp (SQLite's main author) has talked about problems that came up from releasing it into the public domain. He eventually created a second license specifically for companies in places that didn't legally recognize the public domain, and wanted to make sure they were protected from liability. Licensing is complicated.
- greenlakejake 13y ago
  Thanks for the link.
- idupree 13y ago
  CC0 addresses these problems with "public domain"; its intent is the most permissive license that's legally possible (plus, in jurisdictions where it is possible, actually placing the work in the public domain). Unlike the other Creative Commons licenses, it it suitable for source code. ( http://wiki.creativecommons.org/CC0_FAQ http://wiki.creativecommons.org/CC0_FAQ , https://creativecommons.org/choose/zero/ https://creativecommons.org/choose/zero/ )

ciupicri 13y ago

I hate paperwork, but I suppose that providing a document with all the copyright notices along with the car, can't be that bad.

silentbicycle 13y ago
It was never my intention that people who use my open-source library complicate their supply chain by pushing additional work onto their customers. The paperwork wouldn't necessarily just mean slapping a post-it™ note on the product, it could involve paying for lawyers, translators, and so on.
jwr 13y ago
As someone who manages commercial software development projects (also for embedded devices) I can tell you that it is a royal pain to manage the copyright notices. It is a list that has to be created, maintained, updated and has to make its way into the final product or its documentation. You also have to manage copyright notices from software shipped by your partners. While you do this, your programmers will just drop in another library ("But I've checked the license, it's fine, it's BSD!") without telling you. And that library will have dependencies. Overall, if you want to do this right, it's a major pain, for very little actual gain (who reads these copyright notices anyway?).
- silentbicycle 13y ago
  If you have any other recommendations for making this process smoother, please let me know. I want people in your situation to be able to use my libraries without these irritations. (Author of the post.)
  - jwr 13y ago
    The only thing that comes to mind is a unified standard for copyright statements. If I could be sure that there is a file called COPYRIGHT.statement in every source repo, containing a single line of text that I should include in the documentation, it would be a huge step forward. Unfortunately, this would require agreeing on a standard and having people follow it, so I'm not keeping my hopes up.

Symmetry 13y ago

I don't see why this is a problem. The manufacturer of the hardware is the only person bound by the license since they're the only people copying, the only people who need to have the software licensed to them. They're bound to give a copy of that notice to anyone who buys their stuff, but nobody downstream has to care, they're protected by the Doctrine of First Sale[1]. Unless the author lives in a country where that doesn't apply. [1]https://en.wikipedia.org/wiki/First-sale_doctrine https://en.wikipedia.org/wiki/First-sale_doctrine

silentbicycle 13y ago
I probably cannot discuss the specifics of the vendor, but I don't know if First Sale applies in their country. I'm not a lawyer, and their lawyers brought it up as a potential issue, so I'm inclined to take it at face value.

noselasd 13y ago

This is not that uncommon. e.g. many Broadcom SoCs uses various code from opensource projects - Broadcom doesn't sell to end users though. They publish a (small) document to their customers detailing what they have to do as they retail the end product using this particular chip. Which licenses they have to reproduce in documentation and which links to place there pointing to the original source code where that's required. If that's a burden you do not want to place on the customers - indeed, you need to be careful about the selected license.